Endpoint detection and response and managed detection and response show up in the same sentence
so often that they sound like one product. They are not. This excerpt from the Orange Hat Tech Summit
is a short panel on the difference, recorded for owners and managers who approve security spend and
need a plain definition before they compare another quote.
The conversation starts with traditional antivirus. That model is a list of known bad files. If the file is on
the list, the software tries to stop it. Next-generation antivirus adds behavior. Something may not be on
the list, but it acts in a way the software does not expect. Endpoint detection and response sits above
that. The panel describes EDR as watching whether programs on a laptop or other endpoint are doing
work they should not do together. The example is simple: Microsoft Word should not be asking another
application for access it does not need. When that kind of activity shows up, EDR can also help isolate
the machine so an infected PC cannot keep talking to the rest of the network.
Managed detection and response is the people and process around that tool. The panel treats MDR as
the security operations function that watches EDR alerts, uses other tools with it, and acts. Artificial
intelligence is described here as a way to turn a flood of alerts into something a person can respond to.
It is not presented as a replacement for the team.
Jennifer, speaking from the MDR side at WatchGuard, uses a home-security picture. A motion light at
the edge of the property is visibility. A camera is more visibility. Neither one decides what the
movement was, and neither one calls for help. Someone still has to tell a raccoon from a break-in and
take the next step. Endpoints are the far edge of a company network. Laptops and mobile devices often
hold important data, and they are harder to control than systems that stay in the office. That is why the
endpoint layer matters, and why a watched alert is not the same thing as a response.
Watch this excerpt if you are comparing quotes that say EDR, MDR, or both, and you want the terms
separated before you review your own coverage. Solomon IT recorded the Orange Hat session for
owners who need the distinction in plain language.
Key Takeaways
Traditional antivirus matches known bad files. It does not cover activity that is’t on the list.
Next-generation antivirus looks for suspicious behavior, often using machine learning.
EDR monitors whether programs on an endpoint interact in ways they shouldn’t, and it can help isolate an infected PC from the rest of the network.
MDR is the team and process that watches EDR and other tools, sorts the alerts, and takes the next action.
AI in this discussion is a filter on alert noise, not a substitute for a person who can respond.
Endpoints such as laptops and mobile devices sit farthest from central control and often hold important data, so someone still needs to act on visibility there.